Security

Security

Authentication

• JWT tokens with configurable expiration
• bcrypt password hashing

Authorization

Three roles with different access levels:

• Admin: Full system access
• Operator: Node and command management
• Observer: Read-only access

Security Controls (v0.1.0)

• Rate Limiting: 5/min login, 10/min registration
• Account Lockout: 15-minute lockout after 5 failed attempts
• Password Complexity: Uppercase, lowercase, digit, special char required
• Forced Password Change: Default admin must change password
• Audit Logging: All actions logged with timestamps

Reporting Vulnerabilities

Use GitHub Security Advisories for responsible disclosure.